<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<script>alert("inline script");</script>
<script src="internal.js"></script>
<script src="http://localhost{port}/viewer-csp/viewer-csp/external.js"></script>
</head>
<body onload='alert("onload inline script");'>
No JavaScript alert should show in this window.
</body>
</html>
